# Libraries
import pandas as pd
import numpy as np
import matplotlib.pyplot as plt
import seaborn as sns
import plotly.express as px

# Ignore Warnings
import warnings
warnings.filterwarnings("ignore")

df = pd.read_csv("cybersecurity_attacks.csv")

df.head(5)

# List Columns
df.columns

Index(['Timestamp', 'Source IP Address', 'Destination IP Address',
       'Source Port', 'Destination Port', 'Protocol', 'Packet Length',
       'Packet Type', 'Traffic Type', 'Payload Data', 'Malware Indicators',
       'Anomaly Scores', 'Alerts/Warnings', 'Attack Type', 'Attack Signature',
       'Action Taken', 'Severity Level', 'User Information',
       'Device Information', 'Network Segment', 'Geo-location Data',
       'Proxy Information', 'Firewall Logs', 'IDS/IPS Alerts', 'Log Source'],
      dtype='object')

# Shape of data
print(f"There are {df.shape[0]}, row and {df.shape[1]} columns in the Cybersecruity dataset")

There are 40000, row and 33 columns in the Cybersecruity dataset

# Dataset Info
df.info()

<class 'pandas.core.frame.DataFrame'>
RangeIndex: 40000 entries, 0 to 39999
Data columns (total 25 columns):
 #   Column                  Non-Null Count  Dtype  
---  ------                  --------------  -----  
 0   Timestamp               40000 non-null  object 
 1   Source IP Address       40000 non-null  object 
 2   Destination IP Address  40000 non-null  object 
 3   Source Port             40000 non-null  int64  
 4   Destination Port        40000 non-null  int64  
 5   Protocol                40000 non-null  object 
 6   Packet Length           40000 non-null  int64  
 7   Packet Type             40000 non-null  object 
 8   Traffic Type            40000 non-null  object 
 9   Payload Data            40000 non-null  object 
 10  Malware Indicators      20000 non-null  object 
 11  Anomaly Scores          40000 non-null  float64
 12  Alerts/Warnings         19933 non-null  object 
 13  Attack Type             40000 non-null  object 
 14  Attack Signature        40000 non-null  object 
 15  Action Taken            40000 non-null  object 
 16  Severity Level          40000 non-null  object 
 17  User Information        40000 non-null  object 
 18  Device Information      40000 non-null  object 
 19  Network Segment         40000 non-null  object 
 20  Geo-location Data       40000 non-null  object 
 21  Proxy Information       20149 non-null  object 
 22  Firewall Logs           20039 non-null  object 
 23  IDS/IPS Alerts          19950 non-null  object 
 24  Log Source              40000 non-null  object 
dtypes: float64(1), int64(3), object(21)
memory usage: 7.6+ MB

df.isnull().sum().sort_values(ascending=False)

Alerts/Warnings           20067
IDS/IPS Alerts            20050
Malware Indicators        20000
Firewall Logs             19961
Proxy Information         19851
Attack Type                   0
Geo-location Data             0
Network Segment               0
Device Information            0
User Information              0
Severity Level                0
Action Taken                  0
Attack Signature              0
Timestamp                     0
Source IP Address             0
Anomaly Scores                0
Payload Data                  0
Traffic Type                  0
Packet Type                   0
Packet Length                 0
Protocol                      0
Destination Port              0
Source Port                   0
Destination IP Address        0
Log Source                    0
dtype: int64

# Missing Value by Percentage
df.isnull().sum() / len(df) * 100

Timestamp                  0.0000
Source IP Address          0.0000
Destination IP Address     0.0000
Source Port                0.0000
Destination Port           0.0000
Protocol                   0.0000
Packet Length              0.0000
Packet Type                0.0000
Traffic Type               0.0000
Payload Data               0.0000
Malware Indicators        50.0000
Anomaly Scores             0.0000
Alerts/Warnings           50.1675
Attack Type                0.0000
Attack Signature           0.0000
Action Taken               0.0000
Severity Level             0.0000
User Information           0.0000
Device Information         0.0000
Network Segment            0.0000
Geo-location Data          0.0000
Proxy Information         49.6275
Firewall Logs             49.9025
IDS/IPS Alerts            50.1250
Log Source                 0.0000
dtype: float64

# Determine recent activity
# If the Alert Triggered is present, then it's a yes, else it's a no.
df['Alerts/Warnings'] = df['Alerts/Warnings'].apply(lambda x: 'yes' if x == 'Alert Triggered' else 'no')

#If the Malware Indicators is present, then it's a No, else it's a No Detection.
df['Malware Indicators'] = df['Malware Indicators'].apply(lambda x: 'No Detection' if pd.isna(x) else x)

#If Proxy Information is missing, it is assumed that there is no proxy
df['Proxy Information'] = df['Proxy Information'].apply(lambda x: 'No proxy' if pd.isna(x) else x)

#If Firewall Logs is missing, it is assumed that there is no data
df['Firewall Logs'] = df['Firewall Logs'].apply(lambda x: 'No Data' if pd.isna(x) else x)

#If IDS/IPS Alerts is "No Data", then it means that the alert was not generated by IDS/IPS.
df['IDS/IPS Alerts'] = df['IDS/IPS Alerts'].apply(lambda x: 'No Data' if pd.isna(x) else x)

df.isnull().sum().sort_values(ascending=False)

Timestamp                 0
Attack Type               0
IDS/IPS Alerts            0
Firewall Logs             0
Proxy Information         0
Geo-location Data         0
Network Segment           0
Device Information        0
User Information          0
Severity Level            0
Action Taken              0
Attack Signature          0
Alerts/Warnings           0
Source IP Address         0
Anomaly Scores            0
Malware Indicators        0
Payload Data              0
Traffic Type              0
Packet Type               0
Packet Length             0
Protocol                  0
Destination Port          0
Source Port               0
Destination IP Address    0
Log Source                0
dtype: int64

df['Device Information'].value_counts()

Device Information
Mozilla/5.0 (compatible; MSIE 6.0; Windows NT 6.2; Trident/3.0)                                                                                       35
Mozilla/5.0 (compatible; MSIE 5.0; Windows 98; Trident/4.1)                                                                                           34
Mozilla/5.0 (compatible; MSIE 6.0; Windows CE; Trident/4.0)                                                                                           33
Mozilla/5.0 (compatible; MSIE 7.0; Windows NT 6.0; Trident/3.0)                                                                                       31
Mozilla/5.0 (compatible; MSIE 5.0; Windows NT 5.2; Trident/4.1)                                                                                       31
                                                                                                                                                      ..
Mozilla/5.0 (Macintosh; PPC Mac OS X 10_9_2; rv:1.9.2.20) Gecko/6474-09-17 07:53:12 Firefox/3.6.9                                                      1
Mozilla/5.0 (iPhone; CPU iPhone OS 14_2 like Mac OS X) AppleWebKit/535.0 (KHTML, like Gecko) CriOS/19.0.850.0 Mobile/88P921 Safari/535.0               1
Mozilla/5.0 (Windows NT 5.0; km-KH; rv:1.9.2.20) Gecko/7799-03-13 07:30:55 Firefox/3.8                                                                 1
Mozilla/5.0 (X11; Linux i686; rv:1.9.7.20) Gecko/6248-04-01 13:49:59 Firefox/3.8                                                                       1
Mozilla/5.0 (iPod; U; CPU iPhone OS 3_0 like Mac OS X; tg-TJ) AppleWebKit/534.33.5 (KHTML, like Gecko) Version/4.0.5 Mobile/8B116 Safari/6534.33.5     1
Name: count, Length: 32104, dtype: int64

# Extract 'Device'
df['Browser'] = df['Device Information'].str.split('/').str[0]

# created the Browser column.
df['Browser']

0        Mozilla
1        Mozilla
2        Mozilla
3        Mozilla
4        Mozilla
          ...   
39995    Mozilla
39996    Mozilla
39997    Mozilla
39998    Mozilla
39999    Mozilla
Name: Browser, Length: 40000, dtype: object

import re
# OS and device patterns to search for
patterns = [
    r'Windows',
    r'Linux',
    r'Android',
    r'iPad',
    r'iPod',
    r'iPhone',
    r'Macintosh',
]

def extract_device_or_os(user_agent):
    for pattern in patterns:
        match = re.search(pattern, user_agent, re.I)  # re.I makes the search case-insensitive
        if match:
            return match.group()
    return 'Unknown'  # Return 'Unknown' if no patterns match

# Extract device or OS
df['Device/OS'] = df['Device Information'].apply(extract_device_or_os)

df['Browser'].value_counts()

Browser
Mozilla    31951
Opera       8049
Name: count, dtype: int64

df['Device/OS'].value_counts()

Device/OS
Windows      17953
Linux         8840
Macintosh     5813
iPod          2656
Android       1620
iPhone        1567
iPad          1551
Name: count, dtype: int64

#Dropping the Device Information Column
df = df.drop('Device Information', axis = 1)

def extract_time_features(df, Timestamp):
    # Convert timestamp column to datetime if it's not already
    df[Timestamp] = pd.to_datetime(df[Timestamp])
    
    # Extract time features
    df['Year'] = df[Timestamp].dt.year
    df['Month'] = df[Timestamp].dt.month
    df['Day'] = df[Timestamp].dt.day
    df['Hour'] = df[Timestamp].dt.hour
    df['Minute'] = df[Timestamp].dt.minute
    df['Second'] = df[Timestamp].dt.second
    df['DayOfWeek'] = df[Timestamp].dt.dayofweek
    
    return df

# Assuming df is your DataFrame
# Call the function and store the result in a new DataFrame
new_df = extract_time_features(df, 'Timestamp')

# Check if new columns are created
print(new_df.head())

            Timestamp Source IP Address Destination IP Address  Source Port   
0 2023-05-30 06:33:58     103.216.15.12           84.9.164.252        31225  \
1 2020-08-26 07:08:30    78.199.217.198         66.191.137.154        17245   
2 2022-11-13 08:23:25      63.79.210.48          198.219.82.17        16811   
3 2023-07-02 10:38:46     163.42.196.10        101.228.192.255        20018   
4 2023-07-16 13:11:07     71.166.185.76        189.243.174.238         6131   

   Destination Port Protocol  Packet Length Packet Type Traffic Type   
0             17616     ICMP            503        Data         HTTP  \
1             48166     ICMP           1174        Data         HTTP   
2             53600      UDP            306     Control         HTTP   
3             32534      UDP            385        Data         HTTP   
4             26646      TCP           1462        Data          DNS   

                                        Payload Data  ... Log Source  Browser   
0  Qui natus odio asperiores nam. Optio nobis ius...  ...     Server  Mozilla  \
1  Aperiam quos modi officiis veritatis rem. Omni...  ...   Firewall  Mozilla   
2  Perferendis sapiente vitae soluta. Hic delectu...  ...   Firewall  Mozilla   
3  Totam maxime beatae expedita explicabo porro l...  ...   Firewall  Mozilla   
4  Odit nesciunt dolorem nisi iste iusto. Animi v...  ...   Firewall  Mozilla   

   Device/OS  Year Month Day Hour Minute Second DayOfWeek  
0    Windows  2023     5  30    6     33     58         1  
1    Windows  2020     8  26    7      8     30         2  
2    Windows  2022    11  13    8     23     25         6  
3  Macintosh  2023     7   2   10     38     46         6  
4    Windows  2023     7  16   13     11      7         6  

[5 rows x 33 columns]

df.head(5)

df.describe(include = 'object')

df.columns

Index(['Timestamp', 'Source IP Address', 'Destination IP Address',
       'Source Port', 'Destination Port', 'Protocol', 'Packet Length',
       'Packet Type', 'Traffic Type', 'Payload Data', 'Malware Indicators',
       'Anomaly Scores', 'Alerts/Warnings', 'Attack Type', 'Attack Signature',
       'Action Taken', 'Severity Level', 'User Information', 'Network Segment',
       'Geo-location Data', 'Proxy Information', 'Firewall Logs',
       'IDS/IPS Alerts', 'Log Source', 'Browser', 'Device/OS', 'Year', 'Month',
       'Day', 'Hour', 'Minute', 'Second', 'DayOfWeek'],
      dtype='object')

# Checking the Day Column ploting with plotly


plt = px.histogram(
    df, 
    x='Day', 
    color='Malware Indicators', 
    title='Number of Malware Attacks by Day',
    color_discrete_map={'0': 'lightblue', '1': 'salmon'}  # Choose any two contrasting colors
)
plt.show()

# month Distribution

plt = px.histogram(
    df, 
    x='Month', 
    title='Month', 
    color_discrete_sequence=px.colors.qualitative.Pastel  # Using the same Pastel color sequence
)
plt.show()

# Checking the Month Column ploting with plotly
plt = px.histogram(
    df, 
    x='Month', 
    color='Malware Indicators', 
    title='Number of Malware Attacks by Month',
    color_discrete_map={'0': 'lightblue', '1': 'salmon'}  # Choose any two contrasting colors
)
plt.show()

# Year Distrition

plt = px.histogram(
    df, 
    x='Year', 
    title='Year', 
    color_discrete_sequence=px.colors.qualitative.Pastel  # You can specify any color code or name you prefer
)
plt.show()

# Checking the Day Column ploting with plotly

plt = px.histogram(
    df, 
    x='Year', 
    color='Malware Indicators', 
    title='Number of Malware Attacks by Year',
    color_discrete_map={'0': 'lightblue', '1': 'salmon'}  # Choose any two contrasting colors
)
plt.show()

# Checking the Protocol distribution with Bar Chart Using Plotly

plt = px.histogram(
    df, 
    x='Protocol', 
    color='Malware Indicators', 
    title='Number of Malware Attacks by Protocol',
    color_discrete_map={'0': 'lightblue', '1': 'salmon'}  # Choose any two contrasting colors
)
plt.show()

# Traffic Distribution

plt = px.pie(
    df, 
    names='Traffic Type', 
    title='Traffic Distribution', 
    color_discrete_sequence=px.colors.qualitative.Pastel  # Choose any color sequence
)
plt.show()

# Ploting the Traffic Type distribution with Bar Chart Using Plotly

plt = px.histogram(
    df, 
    x='Traffic Type', 
    color='Malware Indicators', 
    title='Number of Malware Attacks by Traffic Type',
    color_discrete_map={'0': 'lightblue', '1': 'salmon'}  # Choose any two contrasting colors
)
plt.show()

# Attack Type Distribution
plt = px.pie(
    df, 
    names='Attack Type', 
    title='Analysing the Attack Type Distribution', 
    color_discrete_sequence=px.colors.qualitative.Pastel  # Choose any color sequence
)
plt.show()

# Checking the attack types distribution with Bar Chart Using Plotly
plt = px.histogram(
    df, 
    x='Attack Type', 
    color='Traffic Type', 
    title='Number of Malware Attacks by Attack Type',
    color_discrete_map={'DNS': 'lightblue', 'HTTP': 'salmon', 'FTP': 'lightgreen'}  # Choose any colors you like
)
plt.show()

# Browsers Distribution
plt = px.pie(
    df, 
    names='Browser', 
    title='Browser Distribution', 
    color_discrete_sequence=px.colors.qualitative.Pastel  # Choose any color sequence
)
plt.show()

# Platform Distribution
plt = px.pie(
    df, 
    names='Device/OS', 
    title='Platform Distribution', 
    color_discrete_sequence=px.colors.qualitative.Pastel  # Choose any color sequence
)
plt.show()

# Platform Distribution with Bar Chart 
plt = px.histogram(df, x ='Device/OS', color= 'Browser', title = 'Platform Distribution')
plt.show()

# Checking the Browser and Devices with Attack Type distribution with Bar Chart Using Plotly
plt = px.histogram(df, x= 'Device/OS', color = 'Attack Type', title = 'Number of Malware Attacks by Browser and Devices')
plt.show()

# checking the browser against the attack type
plt = px.histogram(df, x= 'Browser', color='Attack Type', title= 'Number of Attacks by Browser')
plt.show()

# Log Source Distribution
plt = px.histogram(df, x='Log Source', title='Log Source')
plt.show()

# Log Source Distribution
plt = px.histogram(
    df, 
    x='Action Taken', 
    title='Action Taken',
    color_discrete_sequence=px.colors.qualitative.Pastel  # Use the custom color sequence
)
plt.show()

# Log Source Distribution
plt = px.histogram(df, x='Action Taken', color='Attack Type', title='Log Source')
plt.show()

# Log Source Distribution
plt = px.histogram(df, x='Log Source', color='Attack Type', title='Log Source')
plt.show()

import plotly.graph_objs as go

# Filter data for each attack type
malware_data = df[df['Attack Type'] == 'Malware']['Packet Length']
intrusion_data = df[df['Attack Type'] == 'Intrusion']['Packet Length']
ddos_data = df[df['Attack Type'] == 'DDoS']['Packet Length']

# Create histograms for each attack type
malware_histo = go.Histogram(x=malware_data, name='Malware', opacity=0.7)
intrusion_histo = go.Histogram(x=intrusion_data, name='Intrusion', opacity=0.7)
ddos_histo = go.Histogram(x=ddos_data, name='DDoS', opacity=0.7)

# Create layout
layout = go.Layout(title='Packet Length Distribution for Various Attack Types',
                   xaxis=dict(title='Packet Length'),
                   yaxis=dict(title='Frequency'))

# Create figure
fig = go.Figure(data=[malware_histo, intrusion_histo, ddos_histo], layout=layout)

# Show plot
fig.show()

Column Name	Description
Timestamp	Date and time of the internet activity
Source IP Address	Internet address of the sender
Destination IP Address	Internet address of the receiver
Source Port	Number used by the sender to send information
Destination Port	Number used by the receiver to get information
Protocol	Language used by the devices to talk to each other (e.g., chat, email)
Packet Length	Size of the information package sent over the internet
Packet Type	Kind of information package (e.g., regular message, control message)
Traffic Type	Type of internet activity (e.g., browsing websites, sending emails)
Payload Data	The actual content sent over the internet
Malware Indicators	Signs that something bad (malware) might be trying to sneak in
Anomaly Scores	Numbers showing unusual activity compared to normal internet use
Alerts/Warnings	Notifications from security systems saying something suspicious might be happening
Attack Type	Kind of cyberattack that was done or might be happening (e.g., overwhelming a system with traffic, stealing information)
Attack Signature	Unique fingerprint of a known cyberattack
Action Taken	What was done to stop the threat
Severity Level	How serious the threat was (e.g., not serious, kind of serious, very serious)
User Information	Details about the person using the internet
Device Information	Details about the computer or phone being used
Network Segment	Part of the internet where the activity happened
Geo-location Data	Location information based on internet addresses
Proxy Information	Details about any relays used to connect to the internet
Firewall Logs	Records of what the security system allowed or blocked on the internet
IDS/IPS Alerts	Notifications from systems that watch for cyberattacks
Log Source	Where the information came from (e.g., security software, router)

Project Title : Cybersecurity Attack Analysis¶

About the Dataset :¶

Cybersecurity Dataset¶

Importing the Required Libraries¶

Load the Dataset¶

Exploratory Data Analysis¶

Examining the Null and Missing Values¶

Missing Values in Cybersecurity Dataset¶

First, let's address the missing values.¶

Explore the Device Information Column¶

Data Visualization¶

Network Protocol Descriptions (ICMP, UDP, TCP)¶

Analyse the Traffic Type¶

Analyzing the Attack Type¶

Analyzing the Browser, Devices and Attack Types¶

Analysing the Log Source, Action Taken¶

Packet Length Distribution for Various Attack Types¶

Conclusion¶

Recommendations¶

	Timestamp	Source IP Address	Destination IP Address	Source Port	Destination Port	Protocol	Packet Length	Packet Type	Traffic Type	Payload Data	...	Action Taken	Severity Level	User Information	Device Information	Network Segment	Geo-location Data	Proxy Information	Firewall Logs	IDS/IPS Alerts	Log Source
0	2023-05-30 06:33:58	103.216.15.12	84.9.164.252	31225	17616	ICMP	503	Data	HTTP	Qui natus odio asperiores nam. Optio nobis ius...	...	Logged	Low	Reyansh Dugal	Mozilla/5.0 (compatible; MSIE 8.0; Windows NT ...	Segment A	Jamshedpur, Sikkim	150.9.97.135	Log Data	NaN	Server
1	2020-08-26 07:08:30	78.199.217.198	66.191.137.154	17245	48166	ICMP	1174	Data	HTTP	Aperiam quos modi officiis veritatis rem. Omni...	...	Blocked	Low	Sumer Rana	Mozilla/5.0 (compatible; MSIE 8.0; Windows NT ...	Segment B	Bilaspur, Nagaland	NaN	Log Data	NaN	Firewall
2	2022-11-13 08:23:25	63.79.210.48	198.219.82.17	16811	53600	UDP	306	Control	HTTP	Perferendis sapiente vitae soluta. Hic delectu...	...	Ignored	Low	Himmat Karpe	Mozilla/5.0 (compatible; MSIE 9.0; Windows NT ...	Segment C	Bokaro, Rajasthan	114.133.48.179	Log Data	Alert Data	Firewall
3	2023-07-02 10:38:46	163.42.196.10	101.228.192.255	20018	32534	UDP	385	Data	HTTP	Totam maxime beatae expedita explicabo porro l...	...	Blocked	Medium	Fateh Kibe	Mozilla/5.0 (Macintosh; PPC Mac OS X 10_11_5; ...	Segment B	Jaunpur, Rajasthan	NaN	NaN	Alert Data	Firewall
4	2023-07-16 13:11:07	71.166.185.76	189.243.174.238	6131	26646	TCP	1462	Data	DNS	Odit nesciunt dolorem nisi iste iusto. Animi v...	...	Blocked	Low	Dhanush Chad	Mozilla/5.0 (compatible; MSIE 5.0; Windows NT ...	Segment C	Anantapur, Tripura	149.6.110.119	NaN	Alert Data	Firewall

	Source IP Address	Destination IP Address	Protocol	Packet Type	Traffic Type	Payload Data	Malware Indicators	Alerts/Warnings	Attack Type	Attack Signature	...	Severity Level	User Information	Network Segment	Geo-location Data	Proxy Information	Firewall Logs	IDS/IPS Alerts	Log Source	Browser	Device/OS
count	40000	40000	40000	40000	40000	40000	40000	40000	40000	40000	...	40000	40000	40000	40000	40000	40000	40000	40000	40000	40000
unique	40000	40000	3	2	3	40000	2	2	3	2	...	3	32389	3	8723	20149	2	2	2	2	7
top	103.216.15.12	84.9.164.252	ICMP	Control	DNS	Qui natus odio asperiores nam. Optio nobis ius...	IoC Detected	no	DDoS	Known Pattern A	...	Medium	Ishaan Chaudhari	Segment C	Ghaziabad, Meghalaya	No proxy	Log Data	No Data	Firewall	Mozilla	Windows
freq	1	1	13429	20237	13376	1	20000	20067	13428	20076	...	13435	6	13408	16	19851	20039	20050	20116	31951	17953